Debit card fraud at Michaels Stores in 20 states

Videos

PIN Pads Hacked At Michaels, Robert Siciliano for @Mcafee

see larger video

sourced by cexline

Michaels Stores believed that Illinois was the only state affected by thieves tampering with their debit-card processing machines; however, the store discovered that 20 additional states have been affected as well.

The craft-store chain reported that 90 keypads in 80 stores were compromised in Colorado, Delaware, Georgia, Iowa, Massachusetts, Maryland, Nevada, New Hampshire, New Jersey, New York, North Carolina, Ohio, Oregon, Pennsylvania, Rhode Island, Utah, Virginia and Washington.

Michaels says that it's working with federal and state law-enforcement authorities and is replacing 7,200 card-processing terminals as a precaution. The U.S. Secret Service, which investigates financial fraud, is investigating the incident. Customers must use cash, credit cards or signature-based debit cards until the terminals are replaced.

Michaels has yet to release how the crime happened, but security experts report that crimes like these happen when thieves pose as keypad repair technicians and are given access to the machines by unknowing employees. The thieves swap out the existing keypads for for ones that record account numbers from the magnetic stripe as well as PIN codes from the keypad. Once a card is swiped, it broadcasts the information via a cellular network. Experts note that completing this magnitude scam for 80 stores is rare.

Similar types of fraud happened at Aldi's grocery stores in 11 states last year as well as Hancock Fabrics in three states. This scam also regularly occurs at ATM's and pay-at-the-pump gas station terminals. Experts say that retailers can protect themselves by using the latest keypads with anti-tampering features.

Under federal law, consumers who have experienced debit card fraud only have a limited amount of time to report the crime. If reported within two days, consumers may be liable for up to $50. If reported between two to 60 days, consumers may be liable for up to $500. If reported after 60 days, consumers may not recoup any losses.